Mastercard has updated its virtual card platform, In Control, adding new security controls and embedded payment features, with Citi named as first adopter.
According to the official press release, the company’s VCN ecosystem now spans issuers, direct platforms and corporates operating across 43 countries and territories, including 14 in Asia Pacific, and supports 174 currencies.
A central part of the update is Commercial Connect API, which Mastercard describes as a single point of access for customers to manage and scale virtual card capabilities. The company said the API is intended to address integration challenges in the sector, citing data indicating that 69% of companies struggle to connect payment and business systems. Furthermore, new additions to the platform include the ability to apply multiple control sets at the physical card level, so that controls extend across all related virtual cards without exposing card credentials, as well as a combined process for virtual card creation and payment initiation.
Controls across the payment lifecycle
Mastercard has also introduced Issuer Enforced Controls, a new feature that applies at the point a virtual card number is created. It allows issuers to set baseline parameters such as spend limits, transaction caps, and validity periods before a card is used. This builds on Clearing Controls, introduced in 2025, which extend control checks beyond authorisation into the clearing stage. At the same time, the updated version of Clearing Controls allows corporates and platforms to block invalid transactions, apply more granular rules, and manage payment timing, with centralised policy management as programmes grow. Mastercard said fraud rates on virtual cards are less than one-fifth of those on non-virtual cards, a figure it said is lower still for virtual cards issued through In Control. Citi has already implemented both Issuer Enforced Controls and Clearing Controls and is expected to extend them globally later in 2026.
Embedded payments network expands
Mastercard launched its embedded VCN programme globally in March 2025, and the company said partners across expense management, ERP, accounts payable, travel, hospitality, healthcare, and ecommerce have since joined. In Asia Pacific, Mastercard, Coupa, and HSBC completed the region’s first fully embedded finance virtual card transaction, enabling Pact Group to pay suppliers using virtual cards embedded in its procurement platform. Mastercard also cited partnerships with Juniper Travel, HBX Group, and TravelSoft in the travel sector, and a collaboration with Volo Health in India aimed at automating payment, collection, and reconciliation processes in healthcare.
The updates come as virtual card adoption continues to grow in B2B payments, with providers increasingly differentiating on platform capabilities, integration options, and control features rather than on the underlying card product alone.
